Added tests/suite which contains tests to be executed during
development time and will not be distributed (not included in make dist).
Added "ecore" and a new mini-eagain to test EAGAIN behavior.
Updated cryptodev code to support the linux cryptodev extensions.
Removed the clone() capability from HMAC. It was never used and having
it prevents using it with hardware accelerators that might not have this
capability.
Micah Anderson [Wed, 29 Sep 2010 04:14:56 +0000 (00:14 -0400)]
Add new extended key usage ipsecIKE
According to RFC 4945 § 5.1.3.12 section title "ExtendedKeyUsage"[0] the
following extended key usage has been added:
... this document defines an ExtendedKeyUsage keyPurposeID that MAY be
used to limit a certificate's use:
id-kp-ipsecIKE OBJECT IDENTIFIER ::= { id-kp 17 }
where id-kp is defined in RFC 3280 [5]. If a certificate is intended
to be used with both IKE and other applications, and one of the other
applications requires use of an EKU value, then such certificates
MUST contain either the keyPurposeID id-kp-ipsecIKE or
anyExtendedKeyUsage [5], as well as the keyPurposeID values
associated with the other applications. Similarly, if a CA issues
multiple otherwise-similar certificates for multiple applications
including IKE, and it is intended that the IKE certificate NOT be
used with another application, the IKE certificate MAY contain an EKU
extension listing a keyPurposeID of id-kp-ipsecIKE to discourage its
use with the other application. Recall, however, that EKU extensions
in certificates meant for use in IKE are NOT RECOMMENDED.
Conforming IKE implementations are not required to support EKU. If a
critical EKU extension appears in a certificate and EKU is not
supported by the implementation, then RFC 3280 requires that the
certificate be rejected. Implementations that do support EKU MUST
support the following logic for certificate validation:
o If no EKU extension, continue.
o If EKU present AND contains either id-kp-ipsecIKE or
anyExtendedKeyUsage, continue.
No longer use is_fatal() during handshake. Explicitely treat
EAGAIN and INTERRUPTED as non-fatal during handshake. If the check_fatal
flag is set then GNUTLS_E_WARNING_ALERT_RECEIVED could interrupt
a handshake as well.
fflush stdout and stderr before the call to setbuf. This fixes issue in solaris where lines dissappeared from output. Reported and suggested fix by Knut Anders Hatlen.
This introduces the concept of a "cipher epoch". The epoch number is
the number of successful handshakes and is incremented by one each
time. This concept is native to DTLS and this patch makes the
symmetric cipher state explicit for TLS in preparation for DTLS. This
concept was implicit in plain TLS and ChangeCipherSpec messages
triggered a "pending state copy". Now, we the current epoch number is
simply incremented to the parameters negotiated by the handshake.
The main side effects of this patch is a slightly more abstract
internal API and, in some cases, simpler code. The session blob format
is also changed a bit since this patch avoids storing information that
is now redundant. If this breaks library users' expectations, this
side effect can be negated.
The cipher_specs structure has been removed. The conn_state has become
record_state_st. Only symmetric cipher information is
versioned. Things such as key exchange algorithm and the master secret
are not versioned and their handling is unchanged.
I have tested this patch as much as I could. It introduces no test
suite regressions on my x64 Debian GNU/Linux system.
Do not hesitate to point out shortcomings or suggest changes. Since
this is a big diff, I am expecting this to be an iterative process.
Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Added 3 levels of details in PKCS #11 URLs.
1st level: Token level. Object is unique up to token.
2nd level: Object is unique up to token and module used to access it.
3rd level: Object is unique up to token and module and version of module used to access it.
After a year of not hacking GnuTLS, I needed to look at the code to
know how mbuffers work. This will make it much easier for anybody not
familiar with this code.
Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
PKCS#11 URL support updated to conform to draft-pechanec-pkcs11uri-02.
Now in the URL the pkcs11 provider library (module) can be specified thus restricting
objects within a single provider.
projects / thirdparty / gnutls.git / log
